We are considering going all-in with Mikrotik CCR’s. We just want to hear from others if they are using Mikrotik in enterprise environments with atleast 10GBit int. ?
Our main consideration is SYN flood. We already have DDoS protection from ISP, but some times SYN floods goes trough and as it is now, our firewall becames a bottleneck and CPU goes crazy to 99% and guess what… it cant handle the flood. The firewall used was fortigate 1000C, so even with ASIC power etc, it stilll couldnt handle 600mbit SYN flood. Why? because that was a statefull firewall.
We want mikrotik in front now, and running only stateless but with some ACL, so we get this SYN flood, we can LB it, or route it the single server instead of getting all knocked out because of the fw bottleneck.
I was reading about the performance which wasnt so positive, but that was something with IPsec i think.
How is real life experience with CCR’s ? Anyone who would like to share? We will use the equipment in a hosting company.
Just to elaborate on what Normis posted, we have multiple large enterprise customers that are utilizing MikroTik CCRs in the Entrprise and in the Data Center. If you look through the review we did that Normis posted, there is a link to a MUM presentation we did on using CCRs in HA configurations to go beyond 320 Ggiabits of routed throughput using ECMP and LACP.
We have several load tests that will be published soon on http://www.stubarea51.com as well as an upcoming network design series that highlights using MikroTik solutions in medium and large enterprises.
Some of our customers are multi-billion dollar companies and as we have worked with them to integrate MikroTik into large enterprise and data center environments, they have become comfortable using MikroTik side by side with Cisco,Juniper,etc and in many cases as a direct replacement with an enormous CAPEX savings.
Here is part 2 of the CCR-1072-1G-8S+ which includes extensive testing on BGP performance. Part 3 will include load tests which should be out in the next week or so.
We will give it a try anyway if there is some proper load test 